fix: guard student updates by class owner

src/main/java/com/sztzjy/linkCommerce/controller/stu/UserController.java

@@ -852,7 +852,15 @@ public class UserController {
     @PostMapping("/updateStudent")
     @ApiOperation("学生管理-编辑学生账号信息")
     @AnonymousAccess
-    public ResultEntity updateStudent(@RequestBody Userinfo userInfo) {
+    public ResultEntity updateStudent(@RequestBody Userinfo userInfo, @RequestParam(required = false) String operatorId) {
+        String targetClassId = userInfo.getSchoolClassId();
+        if (StringUtils.isBlank(targetClassId) && StringUtils.isNotBlank(userInfo.getUserId())) {
+            Userinfo existing = userinfoMapper.selectByPrimaryKey(userInfo.getUserId());
+            targetClassId = existing == null ? null : existing.getSchoolClassId();
+        }
+        if (StringUtils.isNotBlank(operatorId) && !canOperateClass(operatorId, targetClassId)) {
+            return new ResultEntity<>(HttpStatus.BAD_REQUEST, "只能维护自己创建班级的学生");
+        }
         int i = userinfoMapper.updateByPrimaryKey(userInfo);
         if (i == 1) {
             return new ResultEntity<>(HttpStatus.OK, "编辑学生账号信息成功！");
@@ -879,7 +887,10 @@ public class UserController {
     @PostMapping("/updateStudentPassword")
     @ApiOperation("学生管理-初始化密码")
     @AnonymousAccess
-    public ResultEntity updateStudentPassword(@RequestParam String userId) {
+    public ResultEntity updateStudentPassword(@RequestParam String userId, @RequestParam(required = false) String operatorId) {
+        if (StringUtils.isNotBlank(operatorId) && !canOperateStudent(operatorId, userId)) {
+            return new ResultEntity<>(HttpStatus.BAD_REQUEST, "只能维护自己创建班级的学生");
+        }
         Userinfo userInfo = userinfoMapper.selectByPrimaryKey(userId);
         userInfo.setPassword("123qwe");
         int i = userinfoMapper.updateByPrimaryKey(userInfo);